If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

AntiOnline Spotlight Tutorial - August 2008: IPv6

While IPv4 addressing is basic knowledge for most of us, the same may not be true for IPv6 addressing.
Below is a quick overview of some IPv4 key points, followed by a primer on IPv6.

IPv4 Addresses

An IPv4 address is expressed in either dotted-decimal notation (e.g. 200.125.248.12) or binary notation (11001000.01111101.11111000.00001100 in this case).

An IPv4 address is divided into two parts: the network ID and the host ID.

The network ID is used to determine what network a packet to send to, while the host ID is used to determine the host within that network. The only constant is that the network ID is always the first part, and the host ID is always the last part, and that both combined are always 32 bits long; how long each part is depends on the subnet mask.

The Subnet Mask

To indicate what part of the 200.125.248.12 address is the network ID and what part is the host ID, we use a subnet mask. Two main notational conventions exist for the subnet mask: the traditional dotted-decimal notation (255.255.255.0, for example, indicates that the first three octets of the IP are the network ID, while the last octet is the host ID), or the newer slash notation (“Classless Inter Domain Routing” (CIDR) notation): /24, for example, indicates that the first 24 bits, or 3 octets, make up the network ID.
Similarly, 255.255.0.0 is /16, 255.0.0.0 is /8, and so on.

Note: while the terms “Class A”, “Class B”, and “Class C” (for /8, /16, and /24, respectively) are still commonly used, they are obsolete.

The /24, /16, and /8 examples are simple, as they happen to coincide with complete octets. Subnet masks, though, are not limited to these values, and it’s important to know how to convert between them. Worth remembering here is that the number behind the slash indicates the number of one-bits in the address: /21, for example, is a subnet mask with 21 one-bits, or 11111111.11111111.11111000.00000000, which converts to 255.255.248.0.

IPv4 Routing

When a computer needs to send an IP packet, it will first determine whether or not the packet needs to be sent locally, or remotely. To determine this, the computer looks at its own subnet mask, and compares the network ID of its own subnet mask to that of the packet’s. If the two match, the computer knows the packet is to be sent locally, and the packet is broadcast on the local network. If the two don’t match, however, the computer knows that the packet is destined for a remote network, and the computer sends the packet to the default gateway (a router on the local network, determined by the default gateway setting on the local computer). That router, upon receiving the packet, checks the network ID, and forwards it to the correct network, where it is broadcast.

IPv4 Address Ranges

- Automatic Private IP Address (APIPA): this address, in the 169.254.0.1 – 169.254.255.254 range, is used by the computer if it is configured to obtain an address automatically, but when no DHCP server is available.

IPv6 addresses can be shortened as follows:
- First, you can get rid of all leading zero’s, and our address becomes 2001:4CEA:8D8C:0:0:0:D2:7A4B
- Next, you can replace all consecutive zero’s with a single double colon: 2001:4CEA:8D8C::D2:7A4B

Types of IPv6 addresses

Remember how there are three main types of IPv4 addresses (APIPA, Private, and Public)? The same is true for IPv6, only they have different names:

- Global Address (GA): this is the equivalent of IPv4’s public address. These addresses start with a first block in the 2000-3FFF range (so the address in the “General” paragraph above is an IPv6 GA, as it starts with 2000)

- Link-Local Address (LLA): this is the equivalent of the IPv4 APIPA address. These addresses always start with “fe80”.

- Unique Local Address (ULA): this is the equivalent of IPv4’s private address. Where IPv4 private addresses fall within three ranges, ULA’s always start with “fd”

If you’re on Windows Vista or Server 2008, you’ll have built-in IPv6 support, and you can see your IPv6 address by opening a command prompt and typing “ipconfig /all”. Here’s actual output from my (Vista) machine:

Note how the machine has a private IPv4 address (192.168.1.102). It also has an IPv6 address (fe80::4cea:2560:8d8c:289d%8).
First note the double colon in the IPv6 address; the actual address is fe80:0000:0000:0000:4cea:2560:8d8c:289d (per the rules above on IPv6 address shortening).

Secondly, note how the IPv6 address is an LLA (starts with “fe80”), and not a ULA as one would expect (since a ULA is the IPv6 equivalent of the private IPv4 address): the reason is simply that my router doesn’t support IPv6, so it can’t assign my computer an ULA IPv6 address.

Important to note about the LLA is that IPv6 will assign this address –and the computer will keep it – even after the computer has been assigned a routable address (in my case, that would be a ULA). This is not the case with IPv4: if a computer is assigned a routable address, the secondary APIPA address is dropped.

Something else you may have noticed: the “%8” behind the IPv6 address. See “Zone ID’s” below for an explanation.

Note how there are three local area connections (Ethernet adapter Local Area Connection, Tunnel adapter Local Area Connection* 11, and Tunnel adapter Local Area Connection* 18). The first adapter is our regular network adapter, as covered above. The second and third adapters are interesting, as they signify transitioning technologies (implemented to make IPv4 and IPv6 coexist). The second is a “Teredo Tunneling Pseudo-Interface” – Teredo is a protocol that allows computers to use IPv6 over the Internet, even if those computers are behind routers that only support IPv4 (such as in my case). The third is an ISATAP connection, with ISATAP standing for Intra-Site Automatic Tunnel Addressing Protocol. This, like Teredo, is an intermediary protocol (to facilitate communication between IPv4 and IPv6).

The ISATAP address (fe80::5efe:192.168.1.102) is interesting, as you can clearly see in it the private IPv4 address of my computer (192.168.1.102); this is because ISATAP encapsulates the IPv4 address within an IPv6 address.

Zone ID’s

The only thing left to explain is the “%8” behind the first adapter’s LLA, and the “%20” behind the third adapter’s LLA. All LLA’s have the same network ID (fe80), so it’s impossible to tell from the network ID what interface is connected to it (in my case, it could be the Ethernet adapter Local Area Connection, or it could be the Tunnel Adapter Local Area Connection* 18 – both have an LLA). To specify what interface you are referring to, the zone ID is used (8 and 20 in my case, respectively).

To get an overview of assigned zone ID’s, issue the following command:

There's a general method on most computers to determine the link local address:
1. Take the MAC address. - 00-0C-F1-EB-F0-43
2. Insert FF-FE between the third and fourth bytes. - 00-0C-F1-FF-FE-EB-F0-43
3. Complement the second low order bit of the first byte. - 02-0C-F1-FF-FE-EB-F0-43 (known at this point as the Interface Identifier)
4. Combine the prefix (FE80::/64) with the interface identifier. - FE80::20C:F1FF:FEEB:F043

Your box doesn't seem to follow that.

IT Blog: .:Computer Defense:.PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".